home

totalphotorecovery.exe

Total Photo Recovery

DataRescueProfessional

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from en.softonic.com and multiple other hosts.
Publisher:
DataRescueProfessional

Product:
Total Photo Recovery

Description:
Total Photo Recovery Setup

Version:
3.6.0.211

MD5:
54d659fe7b9968e9022958e6f7b5cf10

SHA-1:
6daf48ea761054c0621b9ff8f007022251245fd8

SHA-256:
c11faad6748d206b1f7ebd9bd1a1679037f0fba3c4c60ba0b62700490e0b5247

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/23/2024 5:24:34 PM UTC  (today)

File size:
2.3 MB (2,376,133 bytes)

Product version:
3.6.0.211

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\totalphotorecovery.exe

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:K9t9Rmg+GAINhdIJ5lRrxnuBvFPD32F3Pu9BA/7dC:Et9RdNIJ3hxuBvFL3DBwdC

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.7846

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file totalphotorecovery.exe has been seen being distributed by the following 3 URLs.

http://en.softonic.com/sads/tracker.php?ev=c&co=IN&sid=4988e0ca383b6a74ddbb84b2876be38f&upv=161604c5f573cdd267379d620bedf629&z=download-cpd&sk=667&abp=0&params=F39B2A32BFC101987B1458170C278E032123FF0E09F5565AD6A3C9E074A2DA0968EE9297C4F07D359835F98BA87BB21C802D35EE856E9BC5597479DDC29C196459690052F391EB82E8406E80408E08D635DBF834B3C1BDA5EF44130E86C560D2AE420A570D43F855E77582284DE04AF41AC15F28EB7ACCDDED5A11D2752E01CBE38B9C235CE854D3F1455D808790514595E7AC4AE34969018D6CFCFA715AA8C6&h=A676BA844A5285D6D5DA12BC0DC5450100B196834FE56F9901377662F7B48769&directdownload=1&f=69718843&d=http://datarescueprofessional.com/.../TotalPhotoRecovery.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=IN&sid=b9a9781469b0e45604683d43c2c7731c&upv=67c68beda01c8f2cfef63b748c59bc51&z=download-cpd&sk=684&abp=0&params=F39B2A32BFC101987B1458170C278E032123FF0E09F5565AD6A3C9E074A2DA0968EE9297C4F07D359835F98BA87BB21C34D0AE2B8AB56FEAF379930A77A2073D0A9E6A35062AED6E945EC4B141B9619F6A4E8D0958AACBE22AB5ADF91413322BD6C7052EF96609A4360DF1FE72B1AF1F423F1845C32A9990BE14126BCAD867353B0172E1D08F6C5693D69E1296EADB7E3E5F3684BF9F58FC400C6870E67859A6&h=BEA27EFDB5A65C7A2DB0DD6CEC93F93563BFE904A1833F0B688AC1406FC65803&directdownload=1&f=69718843&d=http://datarescueprofessional.com/.../TotalPhotoRecovery.exe

http://datarescueprofessional.com/.../TotalPhotoRecovery.exe

Scan totalphotorecovery.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.